fix(core,cli): sanitize URLs in error messages

[kunalrawat425]

• Add sanitizeUrlsInMessage utility to strip trailing sentence punctuation from URLs in error messages (closes Bug: Trailing '.' in antigravity.google URL in error message causes link to not load #28052)
• Apply it to CLI auth error messages
• Add core unit tests for sanitizeUrlsInMessage

[github-actions]

📊 PR Size: size/M

• Lines changed: 55
• Additions: +53
• Deletions: -2
• Files changed: 3

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request improves the usability of error messages by ensuring that URLs embedded within them are not rendered invalid by trailing punctuation. By stripping characters like periods or exclamation marks that often accidentally attach to links, users can more easily copy and navigate to the intended resources directly from their terminal.

Highlights

• Utility Implementation: Introduced the sanitizeUrlsInMessage utility function to automatically remove trailing sentence punctuation from URLs within error messages.
• CLI Integration: Updated the CLI authentication flow to apply URL sanitization to error messages, ensuring links remain functional when copied.
• Testing: Added comprehensive unit tests to verify the sanitization logic against various edge cases, including URLs at the end of sentences and URLs followed by whitespace.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces a sanitizeUrlsInMessage utility to strip trailing punctuation from URLs in error messages, applying it to the sign-in error flow, and adds corresponding unit tests. The review feedback suggests making the URL sanitization regex more robust to handle quotes, parentheses, commas, and semicolons. It also recommends centralizing this sanitization directly within getErrorMessage to simplify the usage in useAuth.ts and adding comprehensive test cases to cover these edge cases.

[gemini-code-assist]

The current regular expression /(https?:\/\/\S+?)([.!?]+)(\s|$)/g has a few limitations:

1. It does not handle other common trailing sentence punctuation like commas (,) or semicolons (;).
2. It fails to sanitize URLs that are enclosed in quotes (e.g., "https://example.com.") or parentheses (e.g., (see https://example.com.)) because the trailing character (quote or parenthesis) prevents matching \s|$.

We can make this much more robust and clean by using a lookahead assertion (?=[\s"')]|$) and including more punctuation characters. This also avoids capturing and restoring the trailing whitespace/character.

export function sanitizeUrlsInMessage(message: string): string {
  return message.replace(/(https?:\/\/\S+?)([,.;!?]+)(?=[\\s\"')]|$)/g, '$1');
}

[gemini-code-assist]

Since we are centralizing the URL sanitization inside getErrorMessage, we no longer need to import sanitizeUrlsInMessage in this file.

import { getErrorMessage } from '@google/gemini-cli-core';

[gemini-code-assist]

With URL sanitization centralized inside getErrorMessage, we can remove the manual call to sanitizeUrlsInMessage here.

Suggested change

	onAuthError(
	`Failed to sign in. Message: ${sanitizeUrlsInMessage(getErrorMessage(e))}`,
	);
	onAuthError(
	`Failed to sign in. Message: ${getErrorMessage(e)}`,
	);

[gemini-code-assist]

Let's add comprehensive test cases to verify the new punctuation handling (commas, semicolons), quotes, parentheses, and the centralized getErrorMessage URL sanitization behavior.

  it('leaves messages without URLs unchanged', () => {
    const msg = 'No URLs here. Just plain text.';
    expect(sanitizeUrlsInMessage(msg)).toBe(msg);
  });

  it('strips trailing comma and semicolon from URL', () => {
    expect(sanitizeUrlsInMessage('Go to https://example.com, or https://example.org;')).toBe(
      'Go to https://example.com or https://example.org',
    );
  });

  it('handles URLs enclosed in quotes or parentheses', () => {
    expect(sanitizeUrlsInMessage('Go to "https://example.com."')).toBe(
      'Go to "https://example.com"'
    );
    expect(sanitizeUrlsInMessage('Go to (https://example.com.)')).toBe(
      'Go to (https://example.com)'
    );
  });
});

describe('getErrorMessage with URL sanitization', () => {
  it('automatically sanitizes URLs in error messages', () => {
    expect(getErrorMessage(new Error('Failed with link: https://example.com.'))).toBe(
      'Failed with link: https://example.com',
    );
  });
});